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Amendments to the Claims : 

This listing of claims replaces all prior versions and listings of claims in this application. 

Listing of Claims: 

1-38. (cancelled) 

39. (Currently amended) An apparatus configured to monitor and audit activity in a network, the 
network utilizes an incremental protocol, the apparatus comprising: 

[[a)]] an analyzer operative being configured to analyze intercepted packets , wherein said packets are 
conveyed by entities in the network^ and being configured to generate analyzed data based on 
information associated with at least some of said packets, the analyzed data being indicative of 
sessions and being indicative of an incremental screen protocol used in each of said sessions ; 

[[b]] a mirror manager being responsive to said analyzed data for generating mirror data representative 
of mirror sessions, each mirror session corresponding to one of said sessions; and 

[[c)]] an audit event analyzer being responsive to said mirror data , said audit event analyzer being 
configured to generate for generating event data representative of inbound audit events and 
outbound audit events, said event data including characteristics relating to at least on-screen field 
location of data being part of the inbound audit events and outbound audit events, said at least 
on-screen field location being representative of at least one operation performed in the network, 
said audit event analyzer being adapted to analyze said event data for extracting extracted data 
from event data representative of an inbound audit event together with the characteristics 
respective of said inbound audit event, and to generate event data representative of a united audit 
event by combining the extracted data with one or more fields in event data representative of an 
outbound audit event based on said characteristics. 
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40. (Previously presented) The apparatus of Claim 39, further comprising a business event analyzer 
for processing at least part of said event data representative of outbound, inbound and united 
audit events and generating data representative of business events. 

4 1 . (Previously presented) The apparatus of Claim 40, further comprising an alerts manager coupled 
to the business event analyzer and being responsive to said data representative of business events 
for generating alerts. 

42. (Previously presented) The apparatus of Claim 41, wherein the alerts manager is configured to 
generate at least some of the alerts based on predetermined thresholds. 

43. (Previously presented) The apparatus of Claim 39, further comprising a first long term storage 
device for storing at least part of said analyzed data. 

44. (Previously presented) The apparatus of Claim 39, further comprising a second long term storage 
device for storing at least part of said mirror data representative of mirror sessions. 

45. (Previously presented) The apparatus of Claim 39, further comprising a compression agent for 
compressing at least part of the mirror data representative of mirror sessions. 

46. (Previously presented) The apparatus of Claim 39, further comprising an encryption agent for 
encrypting at least part of the mirror data representative of mirror sessions. 

47. (Previously presented) The apparatus of Claim 39, further comprising a signature agent for 
digitally signing at least part of the mirror data representative of mirror sessions. 

48. (Currently amended) A method of monitoring and auditing activity in a network, the network 
utilizes an incremental protocol, the method comprising: 

[[a)]] analyzing intercepted packets conveyed by entities in the network; 

[[b)]] generating analyzed data based on information associated with at least some of said packets, the 
analyzed data being indicative of sessions and being indicative of an incremental screen protocol 
used in each of said sessions ; 
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[[c)]] responsive to said analyzed data generating in respect of one or more of said sessions mirror data 
representative of one or more mirror sessions, each mirror session corresponding to a session; 
and 

[[d)]] generating event data representative of inbound audit events and outbound audit events, said 
event data including characteristics relating to at least on-screen field location of data being part 
of the inbound audit events and outbound audit events , said at least on-screen field location being 
representative of at least one operation performed in the network ; 

[[e)]] extracting extracted data from event data representative of an inbound audit event together with 
the characteristics respective of said inbound audit event; and 

[[f)]] generating event data representative of a united audit event by combining the extracted data with 
one or more fields in event data representative of an outbound audit event based on said 
characteristics. 

49. (Previously presented) The method of Claim 48, further comprising processing at least part of 
said event data representative of outbound, inbound and united audit events and generating data 
representative of business events. 

50. (Previously presented) The method of Claim 49, further comprising responsive to said data 
representative of business events generating alerts in respect of at least one of said business 
events. 

5 1 . (Previously presented) The method of Claim 50, wherein generating at least some of the alerts is 
based on predetermined thresholds. 

52. (Previously presented) The method of Claim 48, further comprising storing at least part of the 
analyzed data. 

53. (Previously presented) The method of Claim 48, further comprising storing at least part of the 
mirror data representative of mirror sessions. 
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54. (Previously presented) The method of Claim 48, further comprising compressing at least part of 
said mirror data representative of mirror sessions. 

55. (Previously presented) The method of Claim 48, further comprising encrypting at least part of 
said mirror data representative of mirror sessions. 

56. (Previously presented) The method of Claim 48, further comprising digitally signing at least part 
of said mirror data representative of mirror sessions. 

57. (cancelled) 

58. (Previously presented) A computer program product comprising a computer useable medium 
having computer readable program code embodied therein for performing steps of Claim 48. 

59. (Previously presented) The apparatus of Claim 39, further comprising a terminal responsive to 
said event data representative of a united audit event for displaying said united audit event 
without requiring that preceding outbound and inbound audit events be displayed prior thereto. 
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